1	Human-Computer Interaction Opportunities for Improving Security/Privacy Ben Shneiderman ben@cs.umd.edu Founding Director (1983-2000), Human-Computer Interaction Lab Professor, Department of Computer Science Member, Institutes for Advanced Computer Studies & Systems Research University of Maryland College Park, MD 20742
2
3	User Interface Design Goals Cognitively comprehensible: Consistent, predictable & controllable Affectively acceptable: Mastery, satisfaction & responsibility NOT: Adaptive, autonomous & anthropomorphic
4	Scientific Approach (beyond user friendly) Specify users and tasks Predict and measure time to learn speed of performance rate of human errors human retention over time Assess subjective satisfaction (Questionnaire for User Interface Satisfaction) Accommodate individual differences Consider social, organizational & cultural context
5	Design Issues Input devices & strategies Keyboards, pointing devices, voice Direct manipulation Menus, forms, commands Output devices & formats Screens, windows, color, sound Text, tables, graphics Instructions, messages, help Collaboration & communities Manuals, tutorials, training
6	U.S. Library of Congress Scholars, Journalists, Citizens Teachers, Students
7	Visible Human Explorer (NLM) Doctors Surgeons Researchers Students
8	NASA Environmental Data Scientists Farmers Land planners Students
9	Bureau of the Census Economists, Policy makers, Journalists Teachers, Students
10	NSF Digital Government Initiative Find what you need Understand what you Find
11	International Children’s Digital Libary
12	Piccolo: Toolkit for 2D zoomable objects Structured canvas of graphical objects in a hierarchical scenegraph Zooming animation Cameras, layers Open, Extensible & Efficient Java, C#, PocketPC versions www.cs.umd.edu/hcil/piccolo
13	PhotoMesa
14	Pocket PhotoMesa
15	CRA Grand Challenges, 2003
16	PITAC Report, 2005 - Challenges
17	Profusion of Concepts for Security/Privacy
18	Profusion of Concepts for Security/Privacy
19	Profusion of Concepts for Security/Privacy
20	Profusion of Concepts for Security/Privacy
21	Security setting - IE
22	Security zones – Online Help
23	Privacy setting
24	Privacy setting – Online Help
25	VPN Virtual Private Network
26	MS Word Security
27	Emerging Research Saltzer & Schroeder, IEEE, 1975 Adams & Sasse, CACM, 1999 Whitten & Tygar, USENIX, 1999 “Why Johnny Can’t Encrypt” Gene Spafford, Purdue Univ Center for Education and Research Information and Assurance and Security Ka-Ping Yee, UC-Berkeley, 2002
28	Guidelines Match the most comfortable way to do tasks with the least granting of authority Grant authority to others in accordance with user actions indicating consent Offer the user ways to reduce others' authority to access the user's resources Maintain accurate awareness - of others' authority as relevant to user decisions - the user's own authority to access resources
29	Guidelines Protect the user's channels to agents that manipulate authority on the user's behalf Enable the user to express safe security policies in terms that fit the user's task Draw distinctions among objects and actions along boundaries relevant to the task Present objects and actions using distinguishable, truthful appearances Indicate clearly the consequences of decisions that the user is expected to make
30	Emerging Research Good & Krekelberg, CHI 2003, Kazaa Simson Garfinkel, MIT, 2004 (David Clark, Rob Miller) Lorrie Cranor, CMU Center for Usable Privacy and Security (CUPS) Symposium on Usable Privacy and Security (SOUPS 2005) Karat, Karat & Brodie, IJHCS 2005 Special Issue: HCI Privacy & Security
31	Controlled Experiment: XPFP (Maxion & Reeder, IJHCS Special Issue, 2005)
32	Controlled Experiment: Salmon (Maxion & Reeder, IJHCS Special Issue, 2005)
33	Controlled Experiments 12 subjects for each interface Successful users: XPFP=178s Salmon=61s (Maxion & Reeder, IJHCS Special Issue, 2005)
34	Possible Strategies Multi-layer interface that: Ties increasing complexity to increasing control Permits evolutionary learning as needed Cleaner cognitive model Fewer objects & actions Clearer feedback about decisions Show consequences of decisions Show dynamics of activity with viewable log
35	Commercial Practice - Usability Engineering User-centered design processes Contextual Design - Beyer and Holtzblatt Participatory Design Guidelines documents and processes User interface building tools Expert reviews and usability testing
36	Usability Testing Physical place and permanent staff vs. discount usability testing Focuses attention on user interface design Encourages iterative testing Pilot test of paper design Online prototype evaluation Refinement of versions Testing of manuals, online help, etc. Rigorous acceptance test Must participate from early stages Must be partners, not "the enemy” (Dumas & Redish, 1999; Nielsen, 1993)
37	Information Visualization- SysAdmin The eye… the window of the soul, is the principal means by which the central sense can most completely and abundantly appreciate the infinite works of nature. Leonardo da Vinci (1452 - 1519)
38	Using Vision to Think Visual bandwidth is enormous Human perceptual skills are remarkable Trend, cluster, gap, outlier... Color, size, shape, proximity... Human image storage is fast and vast Opportunities Spatial layouts & coordination Information visualization Scientific visualization & simulation Telepresence & augmented reality Virtual environments
39	Information Visualization for Security Detecting intrusions Anomaly detection Network Traffic classification Hostile event Link Relationships Security Situation Awareness Fingerprint network attacks Attack Graph complexity Profiling users & traffic Malicious insider detection
40
41
42	Information Visualization: Mantra Overview, zoom & filter, details-on-demand Overview, zoom & filter, details-on-demand Overview, zoom & filter, details-on-demand Overview, zoom & filter, details-on-demand Overview, zoom & filter, details-on-demand Overview, zoom & filter, details-on-demand Overview, zoom & filter, details-on-demand Overview, zoom & filter, details-on-demand Overview, zoom & filter, details-on-demand Overview, zoom & filter, details-on-demand
43	Treemap: Stock market, clustered by industry
44
45
46	Temporal Data: TimeSearcher 1.3 Time series Stocks Weather Genes User-specified patterns Rapid search
47	Temporal Data: TimeSearcher 2.0 Long Time series (>10,000 time points) Multiple variables Controlled precision in match (Linear, offset, noise, amplitude)
48	Multi-V: Hierarchical Clustering Explorer
49	HCE Status In collaboration and sponsored by Eric Hoffman: Children’s National Medical Center Categorical Variables: 4.0 beta, May 2005 60K lines of C++ codes, 58 Classes 2,000+ downloads since April 2002 www.cs.umd.edu/hcil/hce
50
51	For More Information Visit the HCIL website for 350 papers & info on videos www.cs.umd.edu/hcil Conferences & resources: www.infovis.org See Chapter 14 on Info Visualization Shneiderman, B. and Plaisant, C., Designing the User Interface: Strategies for Effective Human-Computer Interaction: Fourth Edition (April 2004) www.awl.com/DTUI Edited Collections: Card, S., Mackinlay, J., and Shneiderman, B. (1999) Readings in Information Visualization: Using Vision to Think Bederson, B. and Shneiderman, B. (2003) The Craft of Information Visualization: Readings and Reflections
52	For More Information Treemaps HiveGroup: www.hivegroup.com Smartmoney: www.smartmoney.com/marketmap HCIL Treemap 4.0: www.cs.umd.edu/hcil/treemap Spotfire: www.spotfire.com TimeSearcher: www.cs.umd.edu/hcil/treemap Hierarchical Clustering Explorer: www.cs.umd.edu/hcil/hce
53	Logical User Centered Interaction Design Design Methodology Management strategy to highlight usability engineering Processes, Deliverables, and Reviews Stages for LUCID 1: Envision 2: Discovery 3: Design Foundation 4: Design Detail 5: Build 6: Release (Cognetics Corp, www.cognetics.com)
54	Guidelines Document and Processes Social process for developers Records decisions for all parties to see Promotes consistency and completeness Facilitates automation of design Should contain philosophy and examples of: title screens, menus, forms, buttons, graphics, icons, fonts, colors, instructions, help, tutorials, error messages, … Multiple levels are desirable: standards, practices, guidelines Education, Enforcement, Exemption & Enhancement
55	Expert Reviews and Usability Testing Improved product quality Shorter development time More predictable development lifecycle Reduced costs Speed development Simplify documentation Facilitate training Lower support Fewer updates Improved organizational reputation Higher morale: staff and management
56	Expert Reviews Experienced reviewers Review every screen, menu, dialog box Spot inconsistencies and anomalies Suggest additions Disciplined approaches Heuristic evaluation: check if goals are being met Guidelines review: verify adherence Consistency inspection: terms, layout, color, sequencing Cognitive walkthrough: pretend to be a user following scenario Formal inspection: public presentation and discussion